@polderlabs/bizar 4.5.1 → 4.7.0

package/bizar-dash/src/server/mods-loader.mjs

@@ -596,7 +596,8 @@ export const modsLoader = {
       const res = await fetch(modJsonUrl);
       if (!res.ok) return null;
       modJson = await res.json();
-    } catch {
+    } catch (err) {
+      console.warn('swallowed in fetchModMetadata:', err.message);
       return null;
     }
     const id = modJson.id;
@@ -674,7 +675,8 @@ export const modsLoader = {
       let entries;
       try {
         entries = readdirSync(p, { withFileTypes: true });
-      } catch {
+      } catch (err) {
+        console.warn('swallowed in mod walk:', err.message);
         return;
       }
       for (const e of entries) {
@@ -913,20 +915,26 @@ export const modsLoader = {
       try {
         out.agents = readdirSync(OPENCODE_AGENTS_DIR)
           .filter((f) => f.startsWith(prefix));
-      } catch { /* ignore */ }
+      } catch (err) {
+        console.warn('swallowed in agents readdir:', err.message);
+      }
     }
     if (existsSync(OPENCODE_COMMANDS_DIR)) {
       try {
         out.commands = readdirSync(OPENCODE_COMMANDS_DIR)
           .filter((f) => f.startsWith(prefix));
-      } catch { /* ignore */ }
+      } catch (err) {
+        console.warn('swallowed in commands readdir:', err.message);
+      }
     }
     if (existsSync(OPENCODE_SKILLS_DIR)) {
       try {
         out.skills = readdirSync(OPENCODE_SKILLS_DIR, { withFileTypes: true })
           .filter((e) => e.isDirectory() && e.name.startsWith(skillPrefix))
           .map((e) => e.name);
-      } catch { /* ignore */ }
+      } catch (err) {
+        console.warn('swallowed in skills readdir:', err.message);
+      }
     }
     return out;
   },

package/bizar-dash/src/server/providers-store.mjs

@@ -38,6 +38,7 @@ import {
   renameSync,
   mkdirSync,
   readdirSync,
+  statSync,
 } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
@@ -66,13 +67,80 @@ function atomicWriteJson(filePath, data) {
   renameSync(tmp, filePath);
 }
 
+// v5.0.0 — Bug S1: 1-second debounced cache for opencode.json reads.
+// `list()`/`listAll()` and other consumers call `loadConfig()` on every
+// WS poll (every ~5s per client) and on every route hit. With N clients
+// that becomes O(N) reads per minute. The cache collapses all reads
+// within a 1-second window to a single read. Writes invalidate so
+// subsequent reads see the new state.
+//
+// The cache lives on `globalThis` so it is shared across all module
+// instances of providers-store.mjs — tests and code that re-imports
+// the module (e.g. via `?cb=` cache-bust) must see the same cache,
+// otherwise a write on one instance becomes invisible to another.
+//
+// The cache also tracks the file's mtime+size and invalidates if the
+// on-disk file has been modified externally (e.g. an editor saving
+// opencode.json, or a test setup writing a fresh file). This prevents
+// stale reads when the file changes outside our write paths.
+const OPENCODE_JSON_CACHE_GLOBAL_KEY = '__bizar_opencode_json_cache__';
+function _opencodeCacheSlot() {
+  if (!globalThis[OPENCODE_JSON_CACHE_GLOBAL_KEY]) {
+    globalThis[OPENCODE_JSON_CACHE_GLOBAL_KEY] = { entry: null, at: 0 };
+  }
+  return globalThis[OPENCODE_JSON_CACHE_GLOBAL_KEY];
+}
+
+const OPENCODE_JSON_CACHE_TTL_MS = 1000;
+
+function _fileStamp(filePath) {
+  // Best-effort stat — if stat fails (file missing, etc.), the caller
+  // will re-read and re-populate the cache.
+  try {
+    const st = statSync(filePath);
+    return `${st.size}:${st.mtimeMs}`;
+  } catch {
+    return null;
+  }
+}
+
+function readOpencodeJsonCached(filePath = OPENCODE_JSON) {
+  const slot = _opencodeCacheSlot();
+  const now = Date.now();
+  if (slot.entry && slot.entry.filePath === filePath) {
+    const age = now - slot.at;
+    if (age < OPENCODE_JSON_CACHE_TTL_MS) {
+      // Fast path: still within TTL. Verify the file hasn't been
+      // modified externally (e.g. another process, an editor, or a
+      // test that writes the file directly). The stamp check is cheap
+      // and protects correctness when the file is touched outside
+      // our write paths.
+      const stamp = _fileStamp(filePath);
+      if (stamp === null || stamp === slot.entry.stamp) {
+        return slot.entry.data;
+      }
+    }
+  }
+  const data = safeReadJSON(filePath, {});
+  slot.entry = { filePath, data, stamp: _fileStamp(filePath) };
+  slot.at = now;
+  return data;
+}
+
+function invalidateOpencodeJsonCache() {
+  const slot = _opencodeCacheSlot();
+  slot.entry = null;
+  slot.at = 0;
+}
+
 function loadConfig() {
-  return safeReadJSON(OPENCODE_JSON, {});
+  return readOpencodeJsonCached(OPENCODE_JSON);
 }
 
 function saveConfig(data) {
   mkdirSync(dirname(OPENCODE_JSON), { recursive: true });
   atomicWriteJson(OPENCODE_JSON, data);
+  invalidateOpencodeJsonCache();
 }
 
 // v4.6.0 — expose the on-disk load/save helpers so route modules can
@@ -81,6 +149,10 @@ function saveConfig(data) {
 // were not exported and config.mjs referenced them implicitly.
 export { loadConfig, saveConfig };
 
+// v5.0.0 — expose cache helpers for tests and other consumers that need
+// to force a re-read (e.g. settings-store after a write).
+export { readOpencodeJsonCached, invalidateOpencodeJsonCache, OPENCODE_JSON_CACHE_TTL_MS };
+
 // ── v4.6.0 Backup-key rotation constants ────────────────────────────────────
 //
 // ERROR_COOLDOWN_THRESHOLD: after this many recorded errors on the same

package/bizar-dash/src/server/routes/chat.mjs

@@ -22,6 +22,7 @@
  *   - Upstream SSE error: clean up and return without crashing.
  */
 import { Router } from 'express';
+import { warn as logWarn } from '../logger.mjs';
 import {
   existsSync,
   mkdirSync,
@@ -53,6 +54,38 @@ const SESSION_ID_RE = /^[A-Za-z0-9_-]{1,120}$/;
 const MAX_CHAT_SUBSCRIPTIONS = 50;
 let activeChatSubscriptions = 0;
 
+/**
+ * v5.0.0 — Bug S3: per-chat-session backpressure cap on the SSE→WS
+ * forwarding pipeline. The upstream SSE can pump deltas faster than
+ * the WS broadcast can flush them if a connected WS client is slow.
+ * `safeSend()` in server.mjs already terminates slow WS clients based
+ * on the byte-level `bufferedAmount`, but we also need a defensive
+ * message-count cap so a single chat session can't accumulate an
+ * unbounded number of queued deltas in this process. When a session
+ * exceeds CHAT_DELTA_BUFFER_CAP, additional deltas are dropped with
+ * a warning log so operators see the issue.
+ */
+const CHAT_DELTA_BUFFER_CAP = 1000;
+const chatDeltaCounts = new Map(); // chatSessionId -> count since idle
+
+function noteChatDelta(chatSessionId) {
+  const cur = chatDeltaCounts.get(chatSessionId) || 0;
+  if (cur >= CHAT_DELTA_BUFFER_CAP) {
+    logWarn('dropped delta for session: per-session cap exceeded; client is too slow', {
+      module: 'chat',
+      sessionId: chatSessionId,
+      cap: CHAT_DELTA_BUFFER_CAP,
+    });
+    return false;
+  }
+  chatDeltaCounts.set(chatSessionId, cur + 1);
+  return true;
+}
+
+function resetChatDeltaCount(chatSessionId) {
+  chatDeltaCounts.delete(chatSessionId);
+}
+
 /**
  * @param {object} deps
  * @param {object} deps.state
@@ -489,6 +522,11 @@ async function streamOpencodeSession({
           // Forward text part deltas as chat:delta
           const textDelta = extractTextDelta(envelope);
           if (textDelta) {
+            // Bug S3 — drop the delta (with warning) if this session
+            // has hit the per-connection cap. The upstream SSE pump
+            // continues, but we stop forwarding to WS to avoid
+            // unbounded buffering here.
+            if (!noteChatDelta(chatSessionId)) return;
             broadcast({
               type: 'chat:delta',
               sessionId: chatSessionId,
@@ -501,6 +539,9 @@ async function streamOpencodeSession({
         onIdle(envelope) {
           if (done) return;
           done = true;
+          // Bug S3 — release the per-session delta counter on idle so
+          // the next prompt starts with a fresh budget.
+          resetChatDeltaCount(chatSessionId);
           // Fetch the final message list and extract the assistant reply.
           void (async () => {
             try {

package/bizar-dash/src/server/routes/lightrag.mjs

@@ -27,6 +27,7 @@ import {
   LIGHTRAG_DEFAULT_EMBEDDING,
 } from '../memory-store.mjs';
 import { resolveLightRAGConfig } from '../memory-lightrag.mjs';
+import { warn as logWarn } from '../logger.mjs';
 import { wrap } from './_shared.mjs';
 
 /**
@@ -127,13 +128,17 @@ export function createLightragRouter({ projectRoot }) {
         const content = readFileSync(logFile, 'utf8');
         const lines = content.split('\n');
         logTail.push(...lines.slice(-30));
-      } catch { /* ignore */ }
+      } catch (err) {
+        logWarn('swallowed in lightrag log tail', { module: 'lightrag', err: err.message });
+      }
     }
 
     let logSize = 0;
     try {
       if (existsSync(logFile)) logSize = statSync(logFile).size;
-    } catch { /* ignore */ }
+    } catch (err) {
+      logWarn('swallowed in lightrag log stat', { module: 'lightrag', err: err.message });
+    }
 
     res.json({
       running: alive,

package/bizar-dash/src/server/routes/memory.mjs

@@ -14,6 +14,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { existsSync, mkdirSync, readFileSync, statSync, readdirSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
+import { warn as logWarn } from '../logger.mjs';
 
 const SERVER_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const memoryStore = await import(`${SERVER_ROOT}/memory-store.mjs`).then((m) => m);
@@ -78,7 +79,9 @@ export function createMemoryRouter({ projectRoot }) {
       try {
         const data = JSON.parse(readFileSync(reindexMarker, 'utf8'));
         lastSecretScan = data.attemptedAt || null;
-      } catch { /* ignore */ }
+      } catch (err) {
+        logWarn('swallowed in memory reindex marker read', { module: 'memory', err: err.message });
+      }
     }
 
     res.json({
@@ -486,7 +489,9 @@ export function createMemoryRouter({ projectRoot }) {
           conflicts.push({ relPath: note.relPath, reason: 'git conflict markers' });
         }
       }
-    } catch { /* ignore */ }
+    } catch (err) {
+      logWarn('swallowed in memory conflict scan', { module: 'memory', err: err.message });
+    }
 
     res.json({ conflicts });
   }));
@@ -523,7 +528,9 @@ export function createMemoryRouter({ projectRoot }) {
     try {
       const { recordQuery } = await getMemoryLightrag();
       recordQuery(projectRoot, Date.now() - startedAt);
-    } catch { /* ignore */ }
+    } catch (err) {
+      logWarn('swallowed in memory recordQuery', { module: 'memory', err: err.message });
+    }
     res.json({ ok: true, q, lexical, semantic });
   }));
 
@@ -605,7 +612,9 @@ export function createMemoryRouter({ projectRoot }) {
         const content = readFileSync(logFile, 'utf8');
         const lines = content.split('\n');
         logTail.push(...lines.slice(-30));
-      } catch {}
+      } catch (err) {
+        logWarn('swallowed in memory log tail', { module: 'memory', err: err.message });
+      }
     }
 
     let lastError = null;

package/bizar-dash/src/server/routes/misc.mjs

@@ -18,6 +18,7 @@ import { searchStore } from '../search-store.mjs';
 import { tailscaleStore } from '../tailscale-store.mjs';
 import { updateStore } from '../update-store.mjs';
 import { projectsStore } from '../projects-store.mjs';
+import { error as logError } from '../logger.mjs';
 import { wrap } from './_shared.mjs';
 
 /**
@@ -81,7 +82,7 @@ export function createMiscRouter({ state, broadcast }) {
     updateStore.applyWithProgress({
       packages,
       broadcast,
-    }).catch((err) => console.error('[updates] error:', err));
+    }).catch((err) => logError('updates error', { module: 'updates', err: err?.message || String(err) }));
     res.json({ started: true, packages });
   });
 

package/bizar-dash/src/server/routes/overview.mjs

@@ -15,6 +15,7 @@ import { agentsStore } from '../agents-store.mjs';
 import { schedulesStore } from '../schedules-store.mjs';
 import { providersStore, mcpsStore } from '../providers-store.mjs';
 import { modsLoader } from '../mods-loader.mjs';
+import { error as logError } from '../logger.mjs';
 import {
   OPENCODE_JSON,
   readSettings,
@@ -56,7 +57,7 @@ export function createOverviewRouter({ state }) {
         },
       );
       child.on('error', (err) => {
-        console.error('[dashboard] restart spawn failed:', err.message);
+        logError('restart spawn failed', { module: 'overview', err: err.message });
       });
       child.unref();
       process.exit(0);

package/bizar-dash/src/server/schedules-runner.mjs

@@ -34,8 +34,8 @@ function logLine(line) {
   try {
     mkdirSync(LOG_DIR, { recursive: true });
     appendFileSync(LOG_FILE, line + '\n', 'utf8');
-  } catch {
-    /* ignore */
+  } catch (err) {
+    console.warn('swallowed in schedule log append:', err.message);
   }
 }
 
@@ -288,8 +288,8 @@ export const schedulesRunner = {
     const projectIds = new Set(reg.projects.map((project) => project.id));
     try {
       if (schedulesStore.list('default').length > 0) projectIds.add('default');
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in schedules due-list:', err.message);
     }
     let skipped = 0;
     for (const projectId of projectIds) {

package/bizar-dash/src/server/server.mjs

@@ -24,6 +24,7 @@ import { agentsStore } from './agents-store.mjs';
 import { tasksStore } from './tasks-store.mjs';
 import { schedulesStore } from './schedules-store.mjs';
 import { providersStore, mcpsStore } from './providers-store.mjs';
+import { readOpencodeJsonCached } from './providers-store.mjs';
 import { homedir } from 'node:os';
 import { startBgPoller, stopBgPoller } from './bg-poller.mjs';
 import { startBgRetryLoop, stopBgRetryLoop } from './bg-retry.mjs';
@@ -38,6 +39,21 @@ import { buildAllowedRootsFromSettings, resolveSafePath } from './lib/path-safe.
 import { V2EventBus } from './v2-event-bus.mjs';
 import { loadOrCreateAuth, V2_DEFAULT_PORT } from './v2-auth-file.mjs';
 import { createV2Router } from './routes-v2/index.mjs';
+import { counter, gauge, render as renderMetrics } from './metrics.mjs';
+
+// v4.7.0 — Prometheus-style HTTP metrics. Bound to the server-wide
+// registry; render() emits the text exposition format consumed by
+// `GET /metrics`. Counter is keyed by {method, route, status} where
+// `route` is the matched Express pattern (e.g. `/api/tasks/:id`) to
+// keep cardinality bounded; unmatched 404s collapse to `unmatched`.
+const httpRequestsTotal = counter(
+  'http_requests_total',
+  'Count of HTTP requests handled by the dashboard server.',
+);
+const wsClientsGauge = gauge(
+  'ws_clients',
+  'Number of currently-connected WebSocket clients (snapshot + /ws/logs).',
+);
 
 let processHandlersInstalled = false;
 let v2Bus = null;
@@ -160,6 +176,46 @@ export async function createServer({
     next();
   });
 
+  // v4.7.0 — Prometheus scrape endpoint. Mounted BEFORE the auth
+  // middleware and OUTSIDE /api/* so scrapers don't need a bearer
+  // token. Returns text/plain in the standard 0.0.4 exposition
+  // format so both Prometheus and `curl http://host/metrics` work.
+  app.get('/metrics', (_req, res) => {
+    res.set('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
+    res.send(renderMetrics());
+  });
+
+  // v4.7.0 — Per-request counter. Uses the matched Express route
+  // pattern (e.g. `/api/tasks/:id`) when available; falls back to
+  // `unmatched` for 404s so the cardinality stays bounded. Hooked off
+  // `finish` so the final status code is captured even after error
+  // handlers run.
+  app.use((req, res, next) => {
+    res.on('finish', () => {
+      const route = req.route?.path ? `${req.baseUrl || ''}${req.route.path}` : 'unmatched';
+      httpRequestsTotal.inc({
+        method: req.method,
+        route,
+        status: String(res.statusCode),
+      });
+    });
+    next();
+  });
+
+  // v4.7.0 — Cache-Control headers for live JSON endpoints. The
+  // frontend pulls these every few seconds, so we use `no-cache` (which
+  // allows conditional revalidation) rather than `no-store` (which
+  // forbids it). Static assets already get `max-age=1y` via
+  // express.static above; this only fills the gap for the live API.
+  app.use('/api/settings', (req, res, next) => {
+    res.setHeader('Cache-Control', 'no-cache');
+    next();
+  });
+  app.use('/api/snapshot', (req, res, next) => {
+    res.setHeader('Cache-Control', 'no-cache');
+    next();
+  });
+
   app.use(
     (
       err,
@@ -281,8 +337,8 @@ export async function createServer({
     if (client.bufferedAmount > WS_BACKPRESSURE_LIMIT_BYTES) {
       try {
         client.terminate();
-      } catch {
-        /* ignore */
+      } catch (err) {
+        console.warn('swallowed in terminate (backpressure):', err.message);
       }
       return false;
     }
@@ -396,8 +452,8 @@ export async function createServer({
       try {
         socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
         socket.destroy();
-      } catch {
-        /* ignore */
+      } catch (err) {
+        console.warn('swallowed in 403 destroy:', err.message);
       }
       return;
     }
@@ -405,8 +461,8 @@ export async function createServer({
       try {
         socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
         socket.destroy();
-      } catch {
-        /* ignore */
+      } catch (err) {
+        console.warn('swallowed in 401 destroy:', err.message);
       }
       return;
     }
@@ -420,8 +476,8 @@ export async function createServer({
       if (client.isAlive === false) {
         try {
           client.terminate();
-        } catch {
-          /* ignore */
+        } catch (err) {
+          console.warn('swallowed in heartbeat terminate:', err.message);
         }
         return;
       }
@@ -431,8 +487,8 @@ export async function createServer({
       } catch {
         try {
           client.terminate();
-        } catch {
-          /* ignore */
+        } catch (err) {
+          console.warn('swallowed in ping-fail terminate:', err.message);
         }
       }
     });
@@ -518,9 +574,16 @@ export async function createServer({
 
   wss.on('connection', (ws, req) => {
     ws.isAlive = true;
+    wsClientsGauge.set(wss.clients.size);
     ws.on('pong', () => {
       ws.isAlive = true;
     });
+    ws.on('close', () => {
+      wsClientsGauge.set(wss.clients.size);
+    });
+    ws.on('error', () => {
+      wsClientsGauge.set(wss.clients.size);
+    });
     const path = req.url
       ? (() => {
           try {
@@ -577,8 +640,8 @@ export async function createServer({
             }
             fileSize = newSize;
           }
-        } catch {
-          /* ignore */
+        } catch (err) {
+          console.warn('swallowed in sendLogChunk:', err.message);
         }
       }
 
@@ -617,8 +680,8 @@ export async function createServer({
           data: buildSnapshotSafe(state, opencodeConfigDir),
         }),
       );
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in ws snapshot send:', err.message);
     }
 
     ws.on('message', (raw) => {
@@ -678,34 +741,34 @@ export async function createServer({
   function close() {
     try {
       stopBgPoller();
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in stopBgPoller:', err.message);
     }
     try {
       stopBgRetryLoop();
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in stopBgRetryLoop:', err.message);
     }
     try {
       watcher.stop();
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in watcher.stop:', err.message);
     }
     try {
       wss.clients.forEach((c) => c.terminate());
       wss.close();
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in wss.close:', err.message);
     }
     try {
       clearInterval(heartbeatInterval);
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in clearInterval:', err.message);
     }
     try {
       server.close();
-    } catch {
-      /* ignore */
+    } catch (err) {
+      console.warn('swallowed in server.close:', err.message);
     }
     currentBroadcast = () => {};
   }
@@ -723,14 +786,15 @@ function buildSnapshotSafe(state, opencodeConfigDir) {
 
 function buildSnapshot(state, opencodeConfigDir) {
   const cfgFile = join(opencodeConfigDir, 'opencode.json');
-  let cfg = null;
-  if (existsSync(cfgFile)) {
-    try {
-      cfg = JSON.parse(readFileSync(cfgFile, 'utf8'));
-    } catch {
-      cfg = null;
-    }
-  }
+  // v5.0.0 — Bug S2: read opencode.json via the 1s-debounced cache in
+  // providers-store.mjs. WS clients connect on snapshot delivery; with N
+  // clients the readFileSync here was the main per-connection blocker.
+  // The cache collapses all reads within a 1-second window to a single
+  // disk hit. Writes (settings change, providers-store mutations)
+  // invalidate the cache, so the snapshot always reflects the latest
+  // state within at most 1s.
+  const exists = existsSync(cfgFile);
+  const cfg = readOpencodeJsonCached();
   const activeProject = projectsStore.active();
   return {
     overview: state.getOverview(),
@@ -740,9 +804,9 @@ function buildSnapshot(state, opencodeConfigDir) {
     activeProject,
     config: {
       path: cfgFile,
-      data: cfg,
-      raw: cfg ? JSON.stringify(cfg, null, 2) : '',
-      exists: existsSync(cfgFile),
+      data: exists ? cfg : null,
+      raw: exists && cfg ? JSON.stringify(cfg, null, 2) : '',
+      exists,
     },
     settings: readSettings(),
     tasks: activeProject ? tasksStore.loadTasks(activeProject.id) : [],

package/bizar-dash/src/server/watcher.mjs

@@ -69,8 +69,8 @@ export function createWatcher({ paths, onChange, options = {} }) {
     async stop() {
       try {
         await watcher.close();
-      } catch {
-        /* ignore */
+      } catch (err) {
+        console.warn('swallowed in watcher.close:', err.message);
       }
     },
     /** Force a synthetic broadcast — useful after a self-mutation. */